Analysis

  • max time kernel
    149s
  • max time network
    143s
  • platform
    windows7_x64
  • resource
    win7-20240611-en
  • resource tags

    arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
  • submitted
    26-06-2024 02:23

General

  • Target

    10686f63d7d573fc32ea32515050610c_JaffaCakes118.dll

  • Size

    138KB

  • MD5

    10686f63d7d573fc32ea32515050610c

  • SHA1

    96d4016d1c24e48871262067023195f2258e3fb1

  • SHA256

    4c94988ce5410f5fa622242b0c939946ef3d30ad72f5fa5b1fb0fb2d8f2a6e6b

  • SHA512

    291b3df439b1866608be3893b13f622a4b19f21de1794e8eb6642dda0b791b82c0494d428b6aa6fe2414195c6e875e59e406bbbad724ed38783384cf46f69d99

  • SSDEEP

    3072:lRB6igBt/cwP9aAnI0wtFEQLOiib3wEzR4rUjS:DXgBlVpnuIwSRq

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

  • UAC bypass 3 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 1 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Impair Defenses: Safe Mode Boot 1 TTPs 3 IoCs
  • Loads dropped DLL 6 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 35 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\10686f63d7d573fc32ea32515050610c_JaffaCakes118.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2944
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\10686f63d7d573fc32ea32515050610c_JaffaCakes118.dll,#1
      2⤵
      • Loads dropped DLL
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:2996
      • C:\Users\Admin\AppData\Local\Temp\798kOP3
        "798kOP3"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1560
        • C:\Windows\SysWOW64\svchost.exe
          C:\Windows\system32\svchost.exe
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2640
        • C:\Windows\SysWOW64\svchost.exe
          C:\Windows\system32\svchost.exe
          4⤵
          • Modifies WinLogon for persistence
          • UAC bypass
          • Checks BIOS information in registry
          • Drops startup file
          • Impair Defenses: Safe Mode Boot
          • Adds Run key to start application
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2772
        • C:\Users\Admin\AppData\Local\Temp\gxdguomqvdxnxutv.exe
          "C:\Users\Admin\AppData\Local\Temp\gxdguomqvdxnxutv.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:2172

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\798kOP3

    Filesize

    95KB

    MD5

    47a8ed36d375f91a1b750411d92ead7f

    SHA1

    b46c4f789f25a704169a21b4b7e4d4ecdda62a5d

    SHA256

    7e1f885a67c2b64aa4549a564f1008f4e96f1a2cd351cd62b6d2b44a8dd03626

    SHA512

    c3f43e560d3b499ab3d0444cfc21a18eb0451aff7466760c0719feadeb4d47445af13968b108cd89fc36e619b9297240075f5a1eec6f6319a88c589a4bc872f7

  • memory/1560-16-0x0000000000320000-0x0000000000321000-memory.dmp

    Filesize

    4KB

  • memory/1560-17-0x0000000000330000-0x0000000000331000-memory.dmp

    Filesize

    4KB

  • memory/1560-42-0x0000000077DDF000-0x0000000077DE0000-memory.dmp

    Filesize

    4KB

  • memory/1560-11-0x0000000000400000-0x000000000043A0DC-memory.dmp

    Filesize

    232KB

  • memory/1560-94-0x0000000002DD0000-0x0000000002E0B000-memory.dmp

    Filesize

    236KB

  • memory/1560-14-0x0000000000400000-0x000000000043A0DC-memory.dmp

    Filesize

    232KB

  • memory/1560-66-0x0000000077DE0000-0x0000000077DE1000-memory.dmp

    Filesize

    4KB

  • memory/1560-40-0x0000000077DE0000-0x0000000077DE1000-memory.dmp

    Filesize

    4KB

  • memory/1560-13-0x0000000000400000-0x000000000043B000-memory.dmp

    Filesize

    236KB

  • memory/1560-85-0x0000000000400000-0x000000000043A0DC-memory.dmp

    Filesize

    232KB

  • memory/1560-25-0x0000000000400000-0x000000000043A0DC-memory.dmp

    Filesize

    232KB

  • memory/1560-87-0x0000000002DD0000-0x0000000002E0B000-memory.dmp

    Filesize

    236KB

  • memory/1560-80-0x0000000000400000-0x000000000043B000-memory.dmp

    Filesize

    236KB

  • memory/1560-81-0x0000000002DD0000-0x0000000002E0B000-memory.dmp

    Filesize

    236KB

  • memory/2172-101-0x0000000000400000-0x000000000043A0DC-memory.dmp

    Filesize

    232KB

  • memory/2172-98-0x0000000000400000-0x000000000043A0DC-memory.dmp

    Filesize

    232KB

  • memory/2640-26-0x0000000020010000-0x000000002001C000-memory.dmp

    Filesize

    48KB

  • memory/2640-31-0x0000000020010000-0x000000002001C000-memory.dmp

    Filesize

    48KB

  • memory/2640-36-0x0000000000090000-0x0000000000091000-memory.dmp

    Filesize

    4KB

  • memory/2640-35-0x00000000000B0000-0x00000000000B1000-memory.dmp

    Filesize

    4KB

  • memory/2640-30-0x0000000020010000-0x000000002001C000-memory.dmp

    Filesize

    48KB

  • memory/2640-21-0x0000000000090000-0x0000000000091000-memory.dmp

    Filesize

    4KB

  • memory/2640-19-0x0000000020010000-0x000000002001C000-memory.dmp

    Filesize

    48KB

  • memory/2640-32-0x0000000020010000-0x000000002001C000-memory.dmp

    Filesize

    48KB

  • memory/2640-37-0x00000000000A0000-0x00000000000A1000-memory.dmp

    Filesize

    4KB

  • memory/2772-63-0x0000000020010000-0x000000002002C000-memory.dmp

    Filesize

    112KB

  • memory/2772-105-0x0000000020010000-0x000000002002C000-memory.dmp

    Filesize

    112KB

  • memory/2772-67-0x0000000020010000-0x000000002002C000-memory.dmp

    Filesize

    112KB

  • memory/2772-76-0x0000000020010000-0x000000002002C000-memory.dmp

    Filesize

    112KB

  • memory/2772-72-0x0000000020010000-0x000000002002C000-memory.dmp

    Filesize

    112KB

  • memory/2772-69-0x0000000020010000-0x000000002002C000-memory.dmp

    Filesize

    112KB

  • memory/2772-39-0x0000000020010000-0x000000002002C000-memory.dmp

    Filesize

    112KB

  • memory/2772-57-0x0000000020010000-0x000000002002C000-memory.dmp

    Filesize

    112KB

  • memory/2772-111-0x0000000020010000-0x000000002002C000-memory.dmp

    Filesize

    112KB

  • memory/2772-56-0x0000000020010000-0x000000002002C000-memory.dmp

    Filesize

    112KB

  • memory/2772-47-0x0000000020010000-0x000000002002C000-memory.dmp

    Filesize

    112KB

  • memory/2772-110-0x0000000020010000-0x000000002002C000-memory.dmp

    Filesize

    112KB

  • memory/2772-109-0x0000000020010000-0x000000002002C000-memory.dmp

    Filesize

    112KB

  • memory/2772-102-0x0000000020010000-0x000000002002C000-memory.dmp

    Filesize

    112KB

  • memory/2772-103-0x0000000020010000-0x000000002002C000-memory.dmp

    Filesize

    112KB

  • memory/2772-104-0x0000000020010000-0x000000002002C000-memory.dmp

    Filesize

    112KB

  • memory/2772-68-0x0000000020010000-0x000000002002C000-memory.dmp

    Filesize

    112KB

  • memory/2772-106-0x0000000020010000-0x000000002002C000-memory.dmp

    Filesize

    112KB

  • memory/2772-107-0x0000000020010000-0x000000002002C000-memory.dmp

    Filesize

    112KB

  • memory/2772-108-0x0000000020010000-0x000000002002C000-memory.dmp

    Filesize

    112KB

  • memory/2996-1-0x0000000059FA0000-0x0000000059FC6000-memory.dmp

    Filesize

    152KB

  • memory/2996-9-0x0000000000130000-0x000000000016B000-memory.dmp

    Filesize

    236KB

  • memory/2996-0-0x0000000059FA0000-0x0000000059FC6000-memory.dmp

    Filesize

    152KB